[Shorewall-users] shorewall and geoip

[Vieri Di Paola]

Hi,

I'm trying to block hosts accessing from some GeoIP IP address ranges.

For instance, I'm unable to block host with src IP address 180.97.106.162.

I installed the GeoIP database in:

# ls /usr/share/xt_geoip/LE/
A1.iv4 BH.iv4 CO.iv4 FO.iv4 HU.iv4 KZ.iv4 MQ.iv4 PF.iv4 SI.iv4 TR.iv4
A1.iv6 BH.iv6 CO.iv6 FO.iv6 HU.iv6 KZ.iv6 MQ.iv6 PF.iv6 SI.iv6 TR.iv6
A2.iv4 BI.iv4 CR.iv4 FR.iv4 ID.iv4 LA.iv4 MR.iv4 PG.iv4 SJ.iv4 TT.iv4
A2.iv6 BI.iv6 CR.iv6 FR.iv6 ID.iv6 LA.iv6 MR.iv6 PG.iv6 SJ.iv6 TT.iv6
AD.iv4 BJ.iv4 CU.iv4 GA.iv4 IE.iv4 LB.iv4 MS.iv4 PH.iv4 SK.iv4 TV.iv4
AD.iv6 BJ.iv6 CU.iv6 GA.iv6 IE.iv6 LB.iv6 MS.iv6 PH.iv6 SK.iv6 TV.iv6
AE.iv4 BL.iv4 CV.iv4 GB.iv4 IL.iv4 LC.iv4 MT.iv4 PK.iv4 SL.iv4 TW.iv4
AE.iv6 BL.iv6 CV.iv6 GB.iv6 IL.iv6 LC.iv6 MT.iv6 PK.iv6 SL.iv6 TW.iv6
AF.iv4 BM.iv4 CW.iv4 GD.iv4 IM.iv4 LI.iv4 MU.iv4 PL.iv4 SM.iv4 TZ.iv4
AF.iv6 BM.iv6 CW.iv6 GD.iv6 IM.iv6 LI.iv6 MU.iv6 PL.iv6 SM.iv6 TZ.iv6
AG.iv4 BN.iv4 CX.iv4 GE.iv4 IN.iv4 LK.iv4 MV.iv4 PM.iv4 SN.iv4 UA.iv4
AG.iv6 BN.iv6 CX.iv6 GE.iv6 IN.iv6 LK.iv6 MV.iv6 PM.iv6 SN.iv6 UA.iv6
AI.iv4 BO.iv4 CY.iv4 GF.iv4 IO.iv4 LR.iv4 MW.iv4 PN.iv4 SO.iv4 UG.iv4
AI.iv6 BO.iv6 CY.iv6 GF.iv6 IO.iv6 LR.iv6 MW.iv6 PN.iv6 SO.iv6 UG.iv6
AL.iv4 BQ.iv4 CZ.iv4 GG.iv4 IQ.iv4 LS.iv4 MX.iv4 PR.iv4 SR.iv4 UM.iv4
AL.iv6 BQ.iv6 CZ.iv6 GG.iv6 IQ.iv6 LS.iv6 MX.iv6 PR.iv6 SR.iv6 UM.iv6
AM.iv4 BR.iv4 DE.iv4 GH.iv4 IR.iv4 LT.iv4 MY.iv4 PS.iv4 SS.iv4 US.iv4
AM.iv6 BR.iv6 DE.iv6 GH.iv6 IR.iv6 LT.iv6 MY.iv6 PS.iv6 SS.iv6 US.iv6
AO.iv4 BS.iv4 DJ.iv4 GI.iv4 IS.iv4 LU.iv4 MZ.iv4 PT.iv4 ST.iv4 UY.iv4
AO.iv6 BS.iv6 DJ.iv6 GI.iv6 IS.iv6 LU.iv6 MZ.iv6 PT.iv6 ST.iv6 UY.iv6
AP.iv4 BT.iv4 DK.iv4 GL.iv4 IT.iv4 LV.iv4 NA.iv4 PW.iv4 SV.iv4 UZ.iv4
AP.iv6 BT.iv6 DK.iv6 GL.iv6 IT.iv6 LV.iv6 NA.iv6 PW.iv6 SV.iv6 UZ.iv6
AQ.iv4 BW.iv4 DM.iv4 GM.iv4 JE.iv4 LY.iv4 NC.iv4 PY.iv4 SX.iv4 VA.iv4
AQ.iv6 BW.iv6 DM.iv6 GM.iv6 JE.iv6 LY.iv6 NC.iv6 PY.iv6 SX.iv6 VA.iv6
AR.iv4 BY.iv4 DO.iv4 GN.iv4 JM.iv4 MA.iv4 NE.iv4 QA.iv4 SY.iv4 VC.iv4
AR.iv6 BY.iv6 DO.iv6 GN.iv6 JM.iv6 MA.iv6 NE.iv6 QA.iv6 SY.iv6 VC.iv6
AS.iv4 BZ.iv4 DZ.iv4 GP.iv4 JO.iv4 MC.iv4 NF.iv4 RE.iv4 SZ.iv4 VE.iv4
AS.iv6 BZ.iv6 DZ.iv6 GP.iv6 JO.iv6 MC.iv6 NF.iv6 RE.iv6 SZ.iv6 VE.iv6
AT.iv4 CA.iv4 EC.iv4 GQ.iv4 JP.iv4 MD.iv4 NG.iv4 RO.iv4 TC.iv4 VG.iv4
AT.iv6 CA.iv6 EC.iv6 GQ.iv6 JP.iv6 MD.iv6 NG.iv6 RO.iv6 TC.iv6 VG.iv6
AU.iv4 CC.iv4 EE.iv4 GR.iv4 KE.iv4 ME.iv4 NI.iv4 RS.iv4 TD.iv4 VI.iv4
AU.iv6 CC.iv6 EE.iv6 GR.iv6 KE.iv6 ME.iv6 NI.iv6 RS.iv6 TD.iv6 VI.iv6
AW.iv4 CD.iv4 EG.iv4 GS.iv4 KG.iv4 MF.iv4 NL.iv4 RU.iv4 TF.iv4 VN.iv4
AW.iv6 CD.iv6 EG.iv6 GS.iv6 KG.iv6 MF.iv6 NL.iv6 RU.iv6 TF.iv6 VN.iv6
AX.iv4 CF.iv4 ER.iv4 GT.iv4 KH.iv4 MG.iv4 NO.iv4 RW.iv4 TG.iv4 VU.iv4
AX.iv6 CF.iv6 ER.iv6 GT.iv6 KH.iv6 MG.iv6 NO.iv6 RW.iv6 TG.iv6 VU.iv6
AZ.iv4 CG.iv4 ES.iv4 GU.iv4 KI.iv4 MH.iv4 NP.iv4 SA.iv4 TH.iv4 WF.iv4
AZ.iv6 CG.iv6 ES.iv6 GU.iv6 KI.iv6 MH.iv6 NP.iv6 SA.iv6 TH.iv6 WF.iv6
BA.iv4 CH.iv4 ET.iv4 GW.iv4 KM.iv4 MK.iv4 NR.iv4 SB.iv4 TJ.iv4 WS.iv4
BA.iv6 CH.iv6 ET.iv6 GW.iv6 KM.iv6 MK.iv6 NR.iv6 SB.iv6 TJ.iv6 WS.iv6
BB.iv4 CI.iv4 EU.iv4 GY.iv4 KN.iv4 ML.iv4 NU.iv4 SC.iv4 TK.iv4 YE.iv4
BB.iv6 CI.iv6 EU.iv6 GY.iv6 KN.iv6 ML.iv6 NU.iv6 SC.iv6 TK.iv6 YE.iv6
BD.iv4 CK.iv4 FI.iv4 HK.iv4 KP.iv4 MM.iv4 NZ.iv4 SD.iv4 TL.iv4 YT.iv4
BD.iv6 CK.iv6 FI.iv6 HK.iv6 KP.iv6 MM.iv6 NZ.iv6 SD.iv6 TL.iv6 YT.iv6
BE.iv4 CL.iv4 FJ.iv4 HN.iv4 KR.iv4 MN.iv4 OM.iv4 SE.iv4 TM.iv4 ZA.iv4
BE.iv6 CL.iv6 FJ.iv6 HN.iv6 KR.iv6 MN.iv6 OM.iv6 SE.iv6 TM.iv6 ZA.iv6
BF.iv4 CM.iv4 FK.iv4 HR.iv4 KW.iv4 MO.iv4 PA.iv4 SG.iv4 TN.iv4 ZM.iv4
BF.iv6 CM.iv6 FK.iv6 HR.iv6 KW.iv6 MO.iv6 PA.iv6 SG.iv6 TN.iv6 ZM.iv6
BG.iv4 CN.iv4 FM.iv4 HT.iv4 KY.iv4 MP.iv4 PE.iv4 SH.iv4 TO.iv4 ZW.iv4
BG.iv6 CN.iv6 FM.iv6 HT.iv6 KY.iv6 MP.iv6 PE.iv6 SH.iv6 TO.iv6 ZW.iv6

I found this range in the GeoIP CSV:

"180.95.128.0","180.127.255.255","3026157568","3028287487","CN","China"

# grep GEOIPDIR /etc/shorewall/shorewall.conf
GEOIPDIR=/usr/share/xt_geoip/LE

# shorewall show capabilities | grep GEO
Geo IP Match (GEOIP_MATCH): Available

rules:
REDIRECT net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] 62000 tcp 80
REDIRECT net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] 62000 tcp 80
REDIRECT net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] 62000 tcp 80
DROP:info net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
DROP:info net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
DROP:info net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all

Is my rule correct?
I understand it should have blocked a CN IP address, right?

I'm attaching a shorewall dump taken after the reported IP address was seen in the IPS (suricata).
I understand it shouldn't have reached NFQUEUE but DROPped before.

Thanks,

Vieri

[Vieri Di Paola]

Hi,

Regarding my previous post, geoip actually seems to be working with:

DROP net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
DROP net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all

DROP net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all

in *most cases*... which means that some packets do arrive to the underlying IPS system via NFQUEUE. The IPS also has a geo-ip rule with the SAME negated set of countries. The weird thing is that I see the IPS logging geoip drops when Shorewall&xtables-addons should have already dropped them all. Some (few) seem to slip through...

I read somewhere that iptables/geoip can accept only up to 10 country codes for each rule. I might be on the edge here and may need to split this into multiple rules.

Vieri

[Tom Eastep]

Post by Vieri Di Paola
Hi,
Regarding my previous post, geoip actually seems to be working
DROP net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all DROP
net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
DROP net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
in *most cases*... which means that some packets do arrive to the
underlying IPS system via NFQUEUE. The IPS also has a geo-ip rule
with the SAME negated set of countries. The weird thing is that I
see the IPS logging geoip drops when Shorewall&xtables-addons
should have already dropped them all. Some (few) seem to slip
through...

In the IPS logs, does it indicate the destination protocol and port of
the offending IPs?

- -Tom
- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________

[Tom Eastep]

Post by Tom Eastep

Post by Vieri Di Paola
Hi,
DROP net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all DROP
net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
DROP net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE] all
in *most cases*... which means that some packets do arrive to the
underlying IPS system via NFQUEUE. The IPS also has a geo-ip
rule with the SAME negated set of countries. The weird thing is
that I see the IPS logging geoip drops when
Shorewall&xtables-addons should have already dropped them all.
Some (few) seem to slip through...

In the IPS logs, does it indicate the destination protocol and port
of the offending IPs?

Please refer to the attached file (included so that the lines don't
get folded by my mailer). This is from net1-fw, but all of the net*-*
chains are similar.

Note that multiple tcp ports, including port 80, are sent to chain
~excl110. That chain returns on source IP matches to IPS_BL and POL_BL
then sends the rest to the IPS. Note that this occurs well before the
geoip rules.

- -Tom


- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________

[Vieri Di Paola]

This post might be inappropriate. Click to display it.

[Tom Eastep]

This post might be inappropriate. Click to display it.

[Tom Eastep]

Post by Tom Eastep
I apologize for replying with HTML, but it would take me an extra
half an hour to make a text version readable.

Sigh -- it still came out poorly....


- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________

[Vieri Di Paola]

________________________________

Post by Tom Eastep
I apologize for replying with HTML, but it would take me an extra half
an hour to make a text version readable.

No problem.

Post by Tom Eastep
You need to include NFQUEUE rules in the ESTABLISHED and RELATED
sections as well as in the NEW section.

I'm now calling NFQUEUE from SECTIONs ESTABLISHED, RELATED and NEW (removed from SECTION ALL).
I've placed my REDIRECT, DROP, and ADD rules in SECTION NEW only.

Everything should be OK now, except maybe for a few things.

In the IPS log I'm seeing almost no GeoIP blocks as expected, since
it's performed by the Shorewall GeoIP rule preceding NFQUEUE in NEW.
However, I'm still seeing one type in the IPS. Here's an example:

"event_type":"drop","src_ip":"188.165.137.78","dest_ip":"172.16.0.1","pr
oto":"ICMP","icmp_type":0,"icmp_code":0

which corresponds to GeoIP IPS rule with the same country codes as the rules used in shorewall.

Shouldn't this have been dropped already by the shorewall rule "DROP net1,net2,net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all"?

By the way, I tried specifying more than 10 country codes for each rule and there doesn't seem to be any errors. I don't know if the limit on 10 country codes still stands.

I've also noticed another issue.
I have a script that keeps reading the IPS log for offending IP addresses. As soon as the IPS drops a packet and logs it, this script also runs the following command immediately:

ipset add IPS_BL <IP>

When this happens for the first time and the offending client hasn't timed out, the client actually succeeds connecting (is NOT dropped) despite the IPS drop log message.
This happens right after running the ipset command above. Of course, I tried temporarily disabling this command in my script and I noticed that the IPS drops the packets correctly even if the client doesn't time out for a long while.
However, I prefer to add the IP address to the ipset so I can drop the next connections from the same IP without having to send it to the IPS again.

This is what I have in rules (SECTION NEW):

REDIRECT:info:blsinf net1:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL 62000 tcp 80
REDIRECT:info:blsinf net2:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL 62000 tcp 80
REDIRECT:info:blsinf net3:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL 62000 tcp 80
DROP net1:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL all
DROP net2:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL all
DROP net3:+IPS_BL,+POL_BL,+GEO_BL,+GEOIPS_BL all

REDIRECT:info:geoipinf net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] 62000 tcp 80
REDIRECT:info:geoipinf net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] 62000 tcp 80
REDIRECT:info:geoipinf net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] 62000 tcp 80
ADD(GEO_BL:src) net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all
ADD(GEO_BL:src) net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all
ADD(GEO_BL:src) net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all
DROP net1:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all
DROP net2:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all
DROP net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all

NFQUEUE(0:5,bypass)... etc. (no other references to IPS_BL in the rest of the rules file)

I don't understand why inserting the IP address in the IPS_BL ipset WHILE the client is still connected and whose connection is being DROPped by the IPS would ALLOW the client connection to go through.

I'm attaching the updated shorewall dump.

Thanks,

Vieri

[Tom Eastep]

Post by Vieri Di Paola
I'm now calling NFQUEUE from SECTIONs ESTABLISHED, RELATED and NEW (removed from SECTION ALL).
I've placed my REDIRECT, DROP, and ADD rules in SECTION NEW only.
Everything should be OK now, except maybe for a few things.
In the IPS log I'm seeing almost no GeoIP blocks as expected, since
it's performed by the Shorewall GeoIP rule preceding NFQUEUE in NEW.
"event_type":"drop","src_ip":"188.165.137.78","dest_ip":"172.16.0.1","pr
oto":"ICMP","icmp_type":0,"icmp_code":0

That is a ping reply -- so 172.16.0.1 is pinging 188.165.137.78.

Post by Vieri Di Paola
which corresponds to GeoIP IPS rule with the same country codes as the

rules used in shorewall.

Post by Vieri Di Paola
Shouldn't this have been dropped already by the shorewall rule

"DROP net1,net2,net3:!^[US,CA,EU,ES,PT,FR,DE,GB,IT,BE,NL] all"?
No, because that packet is in the ESTABLISHED state, not the NEW state.
Your Shorewall ruleset isn't denying systems on your network from
initiating flows to systems that are not in your approved country list.


- -Tom

- --
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________

[Vieri Di Paola]

----- Original Message -----

Post by Tom Eastep

Post by Vieri Di Paola
"event_type":"drop","src_ip":"188.165.137.78","dest_ip":"172.16.0.1","pr
oto":"ICMP","icmp_type":0,"icmp_code":0

That is a ping reply -- so 172.16.0.1 is pinging 188.165.137.78.

I see. It's because of the ICMP type 0 which is an echo reply according to RFC792.

Post by Tom Eastep
No, because that packet is in the ESTABLISHED state, not the NEW state.
Your Shorewall ruleset isn't denying systems on your network from
initiating flows to systems that are not in your approved country list.

All clear, now that I know that it's an ICMP reply.

Thanks,

Vieri